As methods and devices for engaging in financial transactions have increased and expanded into new horizons, age old problems such as fraud and counterfeiting persist. In fact, as applications and devices are developed which make credit or debit based transactions a more attractive and readily available alternative to cash, fraud and counterfeiting activities have seen a proportionate increase.
In order to protect financial institutions, consumers and merchants from the fraudulent use of transaction cards, the industry has developed and introduced many features designed to reduce fraud and counterfeiting such as holograms, special over-layers, and watermarks. Nonetheless, many of these features are proving to be less effective as financial transactions are increasingly being conducted in a wireless environment. Similarly, as financial instruments are increasingly being employed on electronic devices, rather than physical plastic cards, the ability to use techniques such as a customer signature or holograms to verify a party to a transaction is becoming less available.
One of the primary sources of fraud, which is prevalent in the credit card industry is skimming, which refers to the electronic copying of the card's magnetic stripe data to create counterfeit cards. Early skimming was difficult to hide and required cumbersome equipment. As credit card technology has become more sophisticated, so has the technology used by skimmers.
In addition, new forms of skimming have appeared. For example, in one instance a small bug was implanted in a terminal, and left in place for weeks to collect hundreds of card numbers before being removed to harvest the collective card data. Also, one of the more insidious forms of skimming involved line tapping wherein the communication lines between the terminal and the credit card issuer is tapped and the card data extracted from the communications string. One of the most sophisticated examples of line tapping involved skimmers renting an office next to an issuers regional data center and tapping lines going to the issuer computers. The tapped lines were redirected through a computer on the skimmer's site. Compounding the problem, the skimmers were able to remotely access their computer thus permitting the skimmers to harvest the credit card numbers from a remote location. By some estimates, skimming costs financial institutions hundreds of billions of dollars annually. Furthermore, some industry analysts have estimated that each skimmed card will engage in at least $2,000 in transactions before the fraud is uncovered.
Skimming is predominantly a phenomenon afflicting magnetic stripe based transactions. This is because the magnetic stripe, which is placed on the back of a transaction card and stores a variety of data on three separate tracks, is a passive media. In other words, the digital content of the magnetic stripe can be perfectly copied, without any difference between the copy and the original. Largely, this feature is relied upon in legitimate magnetic stripe transactions as a point of sale terminal is simply required to read the data present on the magnetic stripe.
One of the primary means by which skimming can be prevented is for the consumer to closely monitor the whereabouts of their transaction card. This will allow the consumer to prevent the card from being swiped through inappropriate devices. However, as magnetic stripe contactless cards evolve and bring the promise of quick transactions to current payment environments, the classic skimming problem comes along with it. In fact, in a wireless environment the opportunity to skim magnetic stripe data is more prevalent. In a wireless environment, a potential skimmer need not physically possess the card to be skimmed nor have access to any of the physical equipment (e.g. POS terminal, communication lines, etc.) which is required for skimming in a wire based environment. A skimmer can simply, and without knowledge of the consumer or merchant, intercept the wireless transaction and copy the data being transmitted from the card to POS terminal.
Nonetheless, magnetic stripe data and magnetic stripe payment applications are increasingly being deployed on integrated circuit cards or similar devices which have processing capabilities. Accordingly, what is needed is to dynamically generate a verification value for each transaction which can be used to authenticate the transaction. Such an approach to authentication of the payment service will significantly reduce the opportunity for skimming since the verification value is different for each transaction. Therefore, even if the data utilized in a given transaction is skimmed, that data will not be useful in conducting further transactions since the skimmed verification value is not valid for subsequent transactions.